GETTING STARTED

Quickstart

Store a secret, lend scoped access, and make your first brokered call in under five minutes. The password never leaves the vault.

1 · Issue an API key

Create a key in the Token center. Send it as a Bearer token on every request.

export TESSKA_KEY="tsk_live_3f9a…"

Broker consent for one credential and a narrow scope. You get back a short-lived token — not the secret.

curl https://tesska.com/v1/grants \
  -H "Authorization: Bearer $TESSKA_KEY" \
  -d credential=stripe_prod \
  -d scope=charges:read \
  -d ttl=6h

Tesska injects the credential server-side, runs the call within scope, and logs it. Sensitive scopes trigger a mobile approval first.

POST /v1/broker/stripe/charges → 200 OK # logged, scoped, revocable

Never handle raw secrets. Your code holds a Tesska token; the real credential stays encrypted in the vault and can be revoked at any time.